Bug 474768

Created attachment 161784 [details]
New crash information added by DrKonqi

DrKonqi auto-attaching complete backtrace.

Pasting full backtrace of the crashing thread here for searchability:

Thread 1 (Thread 0x7f99739e69c0 (LWP 13974)):
[KCrash Handler]
#4  0x00007f9975b69e30 in __memset_avx2_unaligned_erms () from /lib64/libc.so.6
#5  0x00007f99764b8306 in QVector<int>::fill (from=<optimized out>, asize=-1, this=0x55da2699f900, this@entry=0x55da2699f8f0) at ../../include/QtCore/../../src/corelib/tools/qvector.h:970
#6  QSortFilterProxyModelPrivate::build_source_to_proxy_mapping (proxy_to_source=..., source_to_proxy=..., this=this@entry=0x55da2699f8f0) at itemmodels/qsortfilterproxymodel.cpp:1229
#7  0x00007f99764bc1db in QSortFilterProxyModelPrivate::remove_proxy_interval (emit_signal=true, orient=Qt::Vertical, proxy_parent=..., proxy_end=<optimized out>, proxy_start=<optimized out>, proxy_to_source=..., source_to_proxy=..., this=0x55da26a6aad0) at itemmodels/qsortfilterproxymodel.cpp:819
#8  QSortFilterProxyModelPrivate::remove_source_items (this=this@entry=0x55da26a6aad0, source_to_proxy=..., proxy_to_source=..., source_items=..., source_parent=..., orient=orient@entry=Qt::Vertical, emit_signal=true) at itemmodels/qsortfilterproxymodel.cpp:792
#9  0x00007f99764bc5b1 in QSortFilterProxyModelPrivate::source_items_about_to_be_removed (this=0x55da26a6aad0, source_parent=..., start=0, end=0, orient=Qt::Vertical) at itemmodels/qsortfilterproxymodel.cpp:1094
#10 0x00007f99765257b3 in doActivate<false> (sender=0x55da26992630, signal_index=14, argv=0x7ffc9da9b430) at kernel/qobject.cpp:3937
#11 0x00007f997651e47f in QMetaObject::activate (sender=sender@entry=0x55da26992630, m=m@entry=0x7f99767c5d40, local_signal_index=local_signal_index@entry=11, argv=argv@entry=0x7ffc9da9b430) at kernel/qobject.cpp:3985
#12 0x00007f99764864be in QAbstractItemModel::rowsAboutToBeRemoved (this=this@entry=0x55da26992630, _t1=..., _t2=<optimized out>, _t2@entry=0, _t3=<optimized out>, _t3@entry=0, _t4=...) at .moc/moc_qabstractitemmodel.cpp:599
#13 0x00007f997648ead5 in QAbstractItemModel::beginRemoveRows (this=0x55da26992630, parent=..., first=0, last=0) at itemmodels/qabstractitemmodel.cpp:2818
#14 0x00007f99541ab3b3 in TaskManager::TaskGroupingProxyModel::Private::sourceRowsAboutToBeRemoved (this=0x55da26992770, parent=..., first=<optimized out>, last=1) at /usr/src/debug/plasma-workspace-5.27.8/libtaskmanager/taskgroupingproxymodel.cpp:147
#15 0x00007f9976525812 in QtPrivate::QSlotObjectBase::call (a=0x7ffc9da9b640, r=0x55da26992630, this=0x55da2698dcd0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#16 doActivate<false> (sender=0x55da26992400, signal_index=14, argv=0x7ffc9da9b640) at kernel/qobject.cpp:3925
#17 0x00007f997651e47f in QMetaObject::activate (sender=sender@entry=0x55da26992400, m=m@entry=0x7f99767c5d40, local_signal_index=local_signal_index@entry=11, argv=argv@entry=0x7ffc9da9b640) at kernel/qobject.cpp:3985
#18 0x00007f99764864be in QAbstractItemModel::rowsAboutToBeRemoved (this=this@entry=0x55da26992400, _t1=..., _t2=<optimized out>, _t2@entry=0, _t3=<optimized out>, _t3@entry=1, _t4=...) at .moc/moc_qabstractitemmodel.cpp:599
#19 0x00007f997648ead5 in QAbstractItemModel::beginRemoveRows (this=0x55da26992400, parent=..., first=0, last=1) at itemmodels/qabstractitemmodel.cpp:2818
#20 0x00007f99764bc3b9 in QSortFilterProxyModelPrivate::remove_proxy_interval (emit_signal=true, orient=Qt::Vertical, proxy_parent=..., proxy_end=1, proxy_start=0, proxy_to_source=..., source_to_proxy=..., this=0x55da26995530) at itemmodels/qsortfilterproxymodel.cpp:811
#21 QSortFilterProxyModelPrivate::remove_source_items (this=this@entry=0x55da26995530, source_to_proxy=..., proxy_to_source=..., source_items=..., source_parent=..., orient=orient@entry=Qt::Vertical, emit_signal=true) at itemmodels/qsortfilterproxymodel.cpp:792
#22 0x00007f99764c10a3 in QSortFilterProxyModelPrivate::handle_filter_changed (this=this@entry=0x55da26995530, source_to_proxy=..., proxy_to_source=..., source_parent=..., orient=orient@entry=Qt::Vertical) at itemmodels/qsortfilterproxymodel.cpp:1372
#23 0x00007f99764c14db in QSortFilterProxyModelPrivate::filter_changed (this=0x55da26995530, source_parent=...) at itemmodels/qsortfilterproxymodel.cpp:1305
#24 0x00007f99764c261a in QSortFilterProxyModel::invalidateFilter (this=this@entry=0x55da26992400) at itemmodels/qsortfilterproxymodel.cpp:3067
#25 0x00007f99541ac9a8 in TaskManager::TaskFilterProxyModel::setVirtualDesktop (desktop=..., this=0x55da26992400) at /usr/src/debug/plasma-workspace-5.27.8/libtaskmanager/taskfilterproxymodel.cpp:70
#26 TaskManager::TaskFilterProxyModel::setVirtualDesktop (this=0x55da26992400, desktop=...) at /usr/src/debug/plasma-workspace-5.27.8/libtaskmanager/taskfilterproxymodel.cpp:64
#27 0x00007f9977c9ce0a in QQmlPropertyData::writeProperty (flags=..., value=<optimized out>, target=<optimized out>, this=<optimized out>) at ../../include/QtQml/5.15.10/QtQml/private/../../../../../../src/qml/qml/qqmlpropertydata_p.h:391
#28 QQmlPropertyPrivate::write (object=0x55da26a6aa00, property=..., value=..., context=0x55da26a65390, flags=...) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlproperty.cpp:1305
#29 0x00007f9977c9ef12 in QQmlPropertyPrivate::writeValueProperty (object=<optimized out>, core=..., valueTypeData=..., value=..., context=<optimized out>, flags=..., flags@entry=...) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlproperty.cpp:1214
#30 0x00007f9977d037ac in QQmlBinding::slowWrite (this=this@entry=0x55da26997c10, core=..., valueTypeData=..., result=..., isUndefined=isUndefined@entry=false, flags=..., flags@entry=...) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlbinding.cpp:474
#31 0x00007f9977d04bf0 in GenericBinding<0>::write (this=0x55da26997c10, result=..., isUndefined=false, flags=...) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlbinding.cpp:335
#32 0x00007f9977d0644e in QQmlNonbindingBinding::doUpdate (this=0x55da26997c10, watcher=..., flags=..., scope=...) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlbinding.cpp:258
#33 0x00007f9977d03e64 in QQmlBinding::update (this=0x55da26997c10, flags=...) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlbinding.cpp:194
#34 0x00007f9977ce0e05 in QQmlNotifier::emitNotify (endpoint=<optimized out>, a=0x0) at /usr/src/debug/qtdeclarative-everywhere-src-5.15.10+kde26/src/qml/qml/qqmlnotifier.cpp:104
#35 0x00007f99765250fd in doActivate<false> (sender=0x55da26a68070, signal_index=3, argv=0x0) at kernel/qobject.cpp:3817
#36 0x00007f9976525812 in QtPrivate::QSlotObjectBase::call (a=0x7ffc9da9d6d0, r=0x55da26a68070, this=0x55da26a67dd0) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#37 doActivate<false> (sender=0x55da2618d350, signal_index=3, argv=0x7ffc9da9d6d0) at kernel/qobject.cpp:3925
#38 0x00007f9976525812 in QtPrivate::QSlotObjectBase::call (a=0x7ffc9da9d7a0, r=0x55da2618d350, this=0x55da2663c990) at ../../include/QtCore/../../src/corelib/kernel/qobjectdefs_impl.h:398
#39 doActivate<false> (sender=0x55da26630f90, signal_index=3, argv=0x7ffc9da9d7a0) at kernel/qobject.cpp:3925
#40 0x00007f99785b1962 in ffi_call_unix64 () at ../src/x86/unix64.S:104
#41 0x00007f99785ae2df in ffi_call_int (cif=cif@entry=0x7ffc9da9d9b0, fn=<optimized out>, rvalue=<optimized out>, avalue=<optimized out>, closure=closure@entry=0x0) at ../src/x86/ffi64.c:673
#42 0x00007f99785b0f26 in ffi_call (cif=cif@entry=0x7ffc9da9d9b0, fn=<optimized out>, rvalue=rvalue@entry=0x0, avalue=avalue@entry=0x7ffc9da9da80) at ../src/x86/ffi64.c:710
#43 0x00007f9978988a23 in wl_closure_invoke (closure=closure@entry=0x7f9964005a80, target=<optimized out>, target@entry=0x55da2663c8c0, opcode=opcode@entry=2, data=<optimized out>, flags=1) at ../src/connection.c:1025
#44 0x00007f9978989203 in dispatch_event (display=0x55da25b51600, queue=<optimized out>) at ../src/wayland-client.c:1631
#45 0x00007f9978989494 in dispatch_queue (queue=0x55da25b516f0, display=0x55da25b51600) at ../src/wayland-client.c:1777
#46 wl_display_dispatch_queue_pending (display=0x55da25b51600, queue=0x55da25b516f0) at ../src/wayland-client.c:2019
#47 0x00007f9977926a12 in QtWaylandClient::QWaylandDisplay::flushRequests (this=<optimized out>) at qwaylanddisplay.cpp:255
#48 0x00007f9976519320 in QObject::event (this=0x55da25b4d020, e=0x7f99640020c0) at kernel/qobject.cpp:1347
#49 0x00007f99771a519e in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x55da25b4d020, e=0x7f99640020c0) at kernel/qapplication.cpp:3640
#50 0x00007f99764ed568 in QCoreApplication::notifyInternal2 (receiver=0x55da25b4d020, event=0x7f99640020c0) at kernel/qcoreapplication.cpp:1064
#51 0x00007f99764ed72e in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at kernel/qcoreapplication.cpp:1462
#52 0x00007f99764f0b61 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x55da25b20f50) at kernel/qcoreapplication.cpp:1821
#53 0x00007f99764f10a8 in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at kernel/qcoreapplication.cpp:1680
#54 0x00007f9976546c93 in postEventSourceDispatch (s=0x55da25b65580) at kernel/qeventdispatcher_glib.cpp:277
#55 0x00007f9974f6f9d8 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#56 0x00007f9974f6fde8 in ?? () from /lib64/libglib-2.0.so.0
#57 0x00007f9974f6fe7c in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#58 0x00007f99765464a6 in QEventDispatcherGlib::processEvents (this=0x55da25b72170, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#59 0x00007f99764ebffb in QEventLoop::exec (this=this@entry=0x7ffc9da9dfd0, flags=..., flags@entry=...) at ../../include/QtCore/../../src/corelib/global/qflags.h:69
#60 0x00007f99764f4490 in QCoreApplication::exec () at ../../include/QtCore/../../src/corelib/global/qflags.h:121
#61 0x000055da25a11aa1 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/plasma-workspace-5.27.8/shell/main.cpp:235

*** Bug 468183 has been marked as a duplicate of this bug. ***

*** Bug 475742 has been marked as a duplicate of this bug. ***

beginRemoveRows was emitted twice. Not sure if it's related to the crash.

Can you still reproduce with Qt 5.15.11 ?

*** Bug 475920 has been marked as a duplicate of this bug. ***

Bug 475920 which I just marked as a duplicate is using Qt 5.15.11, so I guess the answer is yes.

In the Archlinux forum, a report said that the applet Power Monitor 0.2 caused the problem https://bbs.archlinux.org/viewtopic.php?id=287373
I tested on OpenSUSE Tumbleweed (had the same problem under this bugreport https://bugs.kde.org/show_bug.cgi?id=475920 ) and removed and re-added Power Monitor 0.2. Now I have no more crashes of plasmashell.

Is everyone else experiencing this crash also using the 3rd-party Power Monitor widget?

(In reply to Nate Graham from comment #10)
> Is everyone else experiencing this crash also using the 3rd-party Power
> Monitor widget?

My crashes too are gone after removing the Power Monitor widget https://store.kde.org/p/1466838

Thanks. Maybe there's some fragility in our code here that we can improve upon, but it seems like the triggering code is in that 3rd-party widget. Leaving this open for now.

I had a clean plasma install and did not have this problem. After installing the "Power Monitor" widget and adding it to the panel, I started experiencing random crashes.

I had repeated random crashes (starting from 5.26) when closing windows, so probably this bug, when I had Energy Monitor visible in my system tray. There might be some shared code between Energy Monitor and Power Monitor that may help pin this down. Before 5.26 the crashes didn't seem to happen (?) Also, after removing Energy Monitor from the system tray and placing it in the panel the crashes stopped.

https://store.kde.org/p/1570454/

*** Bug 481849 has been marked as a duplicate of this bug. ***

*** Bug 471315 has been marked as a duplicate of this bug. ***

I have good news and bad news:

the good news is I know why this crashes and it should no longer happen with Plasma 6.
the bad news is this isn't reliably fixable for Plasma 5.

What happens is a fairly unfortunate set of circumstances. The applets in question all appear to use XHR [1] to access the local file system (deprecated in Qt 5 and actually raising a warning). XHR is implemented using QNAM [2] and that in turn is backed by an implementation of QNAM in KIO. So far so complicated. What happens before the crash is that plasma receives a new window event, feeds it into the grouping system and that issues a beginRemoveRows event. This then triggers QML binding re-evaluation. This causes the aforementioned XHR. Finally things explode because the XHR opens another event loop because of a well known defect [4] where KIO needs to run KJob::exec. During the nested loop another (similar) change event is received by Plasma and processed, changing internal states. When the call chain eventually returns to the original event processing the internal states are not what they should be and things explode.

I'll put some bandaids in place for Plasma 5 but ultimately this problem can manifest in an endless number of ways. All we can do is hope that the bandaids will hold things together well enough.

[1] https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest
[2] https://doc.qt.io/qt-5/qnetworkaccessmanager.html
[3] https://invent.kde.org/frameworks/kio/-/blob/kf5/src/widgets/accessmanager.cpp
[4] https://invent.kde.org/frameworks/kio/-/blob/kf5/src/widgets/accessmanager.cpp#L303

Unfortunately no amount of 🩹 helped with the problem on Plasma 5, fixing one problem just breaks at a different point, so I fear we'll have to accept that these widgets will simply screw over Plasma 5.

For Plasma 6 this is fixed by
- not having XHR enabled at all by default
- even when enabled the XHR doesn't open a nested eventloop anymore thus avoiding the root problem

*** Bug 474358 has been marked as a duplicate of this bug. ***

*** Bug 474726 has been marked as a duplicate of this bug. ***

*** Bug 474925 has been marked as a duplicate of this bug. ***